7 ms·
except if get() can also accept a raw string, which is likely
by baegi 1y ago
except if get() can also accept a raw string, which is likely
- orphea 1y agoWhy would it?
- mcintyre1994 1y agoNo sane library is going to do that. If they do let you pass a raw string it should be a different function with the risks clearly documented. The thing this replaces is every library having their own bespoke API to create a prepared statement on their default/safe path. Now they can just take a template.
- crazygringo 1y agoHow about every library that wants to preserve backwards compatibility? Or are you suggesting that e.g. every database module needs to implement a new set of query functions with new names that supports templates? Which is probably the correct thing to do, but boy is it going to be ugly... So now you'll have to remember never to use 'execute()' but always 'execute_t()' or something.
- WorldMaker 1y agoYou don't have to remember it, you can use deprecation warnings and lint tools to remind you. (Until eventually the safe API is the only API and then you really have nothing to remember.)
- mcintyre1994 1y agoI’d assume their current safe function isn’t taking a string, and is taking some sort of prepared statement? So they could have it take either their prepared statement or a template, and deprecate their prepared statement. If a library has functions taking a string and executing it as SQL they probably shouldn’t make that take a template instead, but I’d hope that’s a separate explicitly unsafe function already.
- crazygringo 1y agoFor sqlite3, it absolutely takes a regular string. If you want to substitute parameters, you put a '?' in the string for each one, and provide an additional (optional) tuple parameter with the variables. So no, there's no explicitly unsafe function. That's my point.
- mcintyre1994 1y agoGotcha. I’d guess they’d want to deprecate that function and create a new one that only accepts a template then, which is definitely annoying! I figured they’d already have more separation between prepared and raw strings which would make it easier.
- deleted 1y ago[deleted]